On Thu, Sep 12, 2013 at 10:22:10AM -0400, Paul Wouters wrote: > > Any co-ercing that happens has to be globally visible, if the target > ensures he is using "random" nameservers to query for data. Not necessarily. First of all, an active attacker located close to the target can simply replace the DNS replies with bogus records, signed by the registrar's key which was either coerced or stolen by the NSA's Key "Recovery" Service. Secondly, if the web site has all of its nameservers run by the same organization (i.e., GoDadddy's DNS service), the nameservers could be set up to return the bogus DNS records only to specific IP addresses or specific IP ranges. Finally, if you think the target can try to find random caching nameservers all across the networ to use, (a) there are certain environments where this is not allowed --- some ISP's or hotel/coffee shop/airline's networks require that you use their name server, and (b) for good and proper reasons, most nameservers have been configured not to allow recursive queries to random IP addresses. > Furthermore, TLDs could institute a delay mechanism with respect to > updating KSK/DS record so a compromised Registrar requesting an updated > DS won't come into effect immediately, and the Registrant has time to > react. A delay mechanism would only work if the TLD sent a notification of a changed KSK/DS record to the Registrant --- but would TLD have access to the contact information for the Registrant? - Ted